← All changes | includes/admin/menu/Approve_Topic.php +26 -4 1.4.1 → 2.2.0 View file →

		@@ -2,9 +2,9 @@
2	2	namespace admin\menu;
3	3
4	4	defined( 'ABSPATH' ) || exit();
5	5
6		-class Approve_Topic {
	6	+class Forumax_Approve_Topic {
7	7	public function __construct() {
8	8	add_action( 'admin_init', [ $this, 'approve_spam_topic' ] );
9	9	add_action( 'admin_init', [ $this, 'approve_pending_reply' ] );
10	10	}
		@@ -12,10 +12,21 @@
12	12	public function approve_spam_topic() {
13	13	$approval_request = $_GET['bbpc_approve_topic_id'] ?? false;
14	14
15	15	if ( $approval_request ) {
	16	+ // Verify user has permission to moderate topics
	17	+ if ( ! current_user_can( 'moderate' ) ) {
	18	+ wp_die( esc_html__( 'You do not have permission to approve topics.', 'forumax' ) );
	19	+ }
	20	+
	21	+ // Verify nonce for CSRF protection
	22	+ if ( ! isset( $_GET['_wpnonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ) ), 'bbpc_approve_topic_' . (int) $approval_request ) ) {
	23	+ wp_die( esc_html__( 'Security check failed. Please try again.', 'forumax' ) );
	24	+ }
	25	+
16	26	bbp_approve_topic( (int) $approval_request );
17		- wp_safe_redirect( admin_url( 'admin.php?page=bbp-core' ) );
	27	+ wp_safe_redirect( admin_url( 'admin.php?page=forumax' ) );
	28	+ exit;
18	29	}
19	30	}
20	31
21	32	public function approve_pending_reply() {
		@@ -21,13 +32,24 @@
21	32	public function approve_pending_reply() {
22	33	$approval_request = $_GET['bbpc_approve_reply_id'] ?? false;
23	34
24	35	if ( $approval_request ) {
	36	+ // Verify user has permission to moderate replies
	37	+ if ( ! current_user_can( 'moderate' ) ) {
	38	+ wp_die( esc_html__( 'You do not have permission to approve replies.', 'forumax' ) );
	39	+ }
	40	+
	41	+ // Verify nonce for CSRF protection
	42	+ if ( ! isset( $_GET['_wpnonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ) ), 'bbpc_approve_reply_' . (int) $approval_request ) ) {
	43	+ wp_die( esc_html__( 'Security check failed. Please try again.', 'forumax' ) );
	44	+ }
	45	+
25	46	bbp_approve_reply( (int) $approval_request );
26		- wp_safe_redirect( admin_url( 'admin.php?page=bbp-core' ) );
	47	+ wp_safe_redirect( admin_url( 'admin.php?page=forumax' ) );
	48	+ exit;
27	49	}
28	50	}
29	51	}
30	52
31		-new Approve_Topic();
	53	+new Forumax_Approve_Topic();
32	54
33	55